Enterprise Virtual Network Security CND Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common method to implement network segmentation in a virtual environment?

   • AIncreasing the number of virtual CPUs on each VM.
   • BUsing VLANs to separate traffic into different broadcast domains.
   • CAssigning all virtual machines to the same subnet.
   • DDisabling the virtual switch's management interface.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network defender suspects that a compromised VM in a virtual network is performing port scans against other VMs. The defender needs to confirm the suspicious activity and identify the source. Which monitoring approach would provide the most direct evidence?

   • AEnable flow logs on the virtual network and analyze them for repeated connection attempts to multiple ports on multiple destinations.
   • BInspect the DNS logs for queries made by the VM.
   • CCheck the VM's local firewall rules for open ports.
   • DReview the hypervisor's event logs for VM power-on and power-off events.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A network defender is hardening a virtual network that hosts VMs with sensitive data. The defender wants to prevent VMs from communicating with each other unless explicitly allowed. Which control should be implemented?

   • APlace all VMs on the same virtual network to simplify management.
   • BEnable VM encryption to protect data in transit.
   • CDisable the virtual switch's promiscuous mode.
   • DConfigure a default-deny rule on the virtual firewall or NSG, and add allow rules only for required communication.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network defender is implementing monitoring for a virtual network that hosts both production and development VMs. The security team wants to detect anomalies, but the development team frequently creates and deletes VMs, causing a high volume of alerts. The defender needs to reduce false positives while maintaining visibility into production traffic. Which approach best balances these requirements?

   • AUse a static threshold for all traffic and alert when any VM exceeds it.
   • BDisable monitoring for the development subnets entirely.
   • CEnable flow logs for all subnets and create a baseline for each VM, then alert only on deviations from the baseline.
   • DMonitor only the hypervisor logs and ignore VM-level traffic.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network defender is comparing virtual and physical network security controls. Which statement accurately reflects a difference that affects security implementation?

   • AVirtual networks allow security policies to be applied to logical constructs such as VM groups, enabling automated and consistent enforcement.
   • BPhysical networks cannot be segmented, while virtual networks can.
   • CVirtual networks are inherently more secure than physical networks because they are isolated from the internet.
   • DVirtual networks do not require monitoring because the hypervisor handles security.
   Reveal Solution Discussion Select an answer first